-1

I'm currently developing a side-project, which will consist of a Database, Web API, and then different Apps on top which consume the restful API.

I've started thinking about User accounts and how to make these secure. Currently, as a standard, I have the following model in the Data Layer:

public int Id { get; set; }
public string Username { get; set; } 
public string Full_Name { get; set; }
public string Password { get; internal set; }
public string Salt { get; internal set; }

Now, obviously, when someone makes a request for /Users/{id}, the User associated with that Id is returned. However, I don't want to return the Password or Salt, so really don't want those to be part of the User model.

I have toyed with the idea of creating a different, internal-only model for UserDetails, and shipping the Password/Salt, etc off into that. However, I hit the snag of, when signing up to the service, how do I get a desired password from the user to the API?

There's probably a really simple implementation of what I want to do, but I can't think of one right now. Any help would be greatly appreciated!

AllFallD0wn
  • 551
  • 7
  • 23

1 Answers1

1

You should use a special view model without the password property for this purpose. Then inside your API you will map between your data model and the view model and return the view model out from your Web API method. Same stands true for the Salt property as well.

Darin Dimitrov
  • 1,023,142
  • 271
  • 3,287
  • 2,928
  • I thought of, and started implementing this, however then I thought about how a user would sign up in this architecture? Any insights would be great :) – AllFallD0wn Feb 22 '15 at 17:28
  • You will have a `SignupViewModel` which will obviously contain the password. everything that you are exposing outside of your API is view models. Your Data Model remains the same and you simply project it to the various view models depending on the context. – Darin Dimitrov Feb 22 '15 at 17:29